UNITED STATES DISTRICT COURT 
EASTERN DISTRICT OF WISCONSIN 


UNITED STATES OF AMERICA, 

Plaintiff, 


v. 


Case No. 17-CR-124 


MARCUS HUTCHINS, 

Defendant. 


PLEA AGREEMENT 


1. The United States of America, by its attorneys, Matthew D. Krueger, 
United States Attorney for the Eastern District of Wisconsin, and Benjamin Proctor 
and Benjamin Taibleson, Assistant United States Attorneys, and the defendant, 
Marcus Hutchins, individually and by attorneys Brian Klein, Marcia Hofmann, and 
Daniel Stiller, pursuant to Rule 11 of the Federal Rules of Criminal Procedure, 
enter into the following plea agreement: 

CHARGES 

2. The defendant has been charged in 10 counts of a superseding 
indictment, which allege violations of Title 18, United States Code, Sections % 371; 
1001(a)(2); 1030(a)(5)(A), (a)(2)(C), (b), (c)(2)(B), (c)(4)(A)(i)(IV), and (e)(4)(B)(i)-(ii); 
251l(l)(a), (4)(a); 2512(l)(a), (l)(b), (l)(c)(i), and (l)(e)(ii); and 1349. 

3. The defendant has read and fully understands the charges contained 
in the indictment. He fully understands the nature and elements of the crimes with 
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which he has been charged, and the charges and the terms and conditions of the 
plea agreement have been fully explained to him by his attorneys. 

4. The defendant voluntarily agrees to plead guilty to Counts One and 
Two of the superseding indictment. 

5. The defendant acknowledges, understands, and agrees that he is, in 
fact, guilty of the offenses described in paragraph 4. The parties acknowledge and 
understand that if this case were to proceed to trial, the government would be able 
to prove the facts in Attachment A, as well as the facts set forth in Counts One and 
Two of the superseding indictment, beyond a reasonable doubt. The defendant 
admits that these facts are true and correct and establish his guilt beyond a 
reasonable doubt. The information in Attachment A is provided for the purpose of 
setting forth a factual basis for the plea of guilty. It is not a full recitation of the 
defendant’s knowledge of, or participation in, the offenses. 

PENALTIES 

6. The parties understand and agree that the offenses to which the 
defendant will enter a plea of guilty carry the following maximum terms of 
imprisonment and fines: 

» Count One: up to 5 years in prison, up to $250,000 in fines, up to 1 year of 
supervised release, and a $100 special assessment. 

* Count Two: up to 5 years in prison, up to $250,000 in fines, up to 1 year of 
supervised release, and a $100 special assessment. 

The parties further recognize that a restitution order may be entered by the court. 
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7. 


The defendant acknowledges, understands, and agrees that he has 


discussed the relevant statutes as well as the applicable sentencing guidelines with 
his attorneys. 


DISMISSAL OF REMAINING COUNTS 

8. The government agrees to move to dismiss the remaining counts at the 
time of sentencing. 


TUT /RMENTS 


9. The parties understand and agree that in order to prove a violation of 
18 U.S.C. § 371 as set forth in Count One, the government must prove each of the 
following propositions beyond a reasonable doubt: 

1. The conspiracy as charged existed; 

2. The defendant knowingly became a member of the conspiracy with the intent 
to advance the conspiracy; and 

3. One of the conspirators committed an overt act in an effort to advance the 
goal of conspiracy. 

The parties understand and agree that in order to prove a violation of 18 
U.S.C. § 2512(l)(c)(i) as set forth in Count Two, the government must prove each of 
the following propositions beyond a reasonable doubt: 

1. The defendant intentionally disseminated by electronic means any 
advertisement of a device; 

2. The defendant knew or had reason to know that the design of the device 
renders it primarily useful for the purpose of the surreptitious interception of 
wire, oral, or electronic communication; 

3. The defendant knew or had reason to know that the advertisement would be 
transported in interstate or foreign commerce. 
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SENTENCING PROVISIONS 


10. The parties agree to waive the time limits in Fed. R. Grim. P. 32 
relating to the presentence report, including that the presentence report be 
disclosed not less than 35 days before the sentencing hearing, in favor of a schedule 
for disclosure, and the filing of any objections, to be established by the court at the 
change of plea hearing. 

11. The parties acknowledge, understand, and agree that any sentence 
imposed by the court will be pursuant to the Sentencing Reform Act, and that the 
court will give due regard to the Sentencing Guidelines when sentencing the 
defendant. 

12. The parties acknowledge and understand that prior to sentencing the 
United States Probation Office will conduct its own investigation of the defendant’s 
criminal history. The parties further acknowledge and understand that, at the time 
the defendant enters a guilty plea, the parties may not have full and complete 
information regarding the defendant’s criminal history. The parties acknowledge, 
understand, and agree that the defendant may not move to withdraw the guilty plea 
solely as a result of the sentencing court’s determination of the defendant’s criminal 
history. 

Sentencing Guidelines Calculations 

13. The defendant acknowledges and understands that the sentencing 

guidelines recommendations contained in this agreement do not create any right to 

be sentenced within any particular sentence range, and that the court may impose a 

reasonable sentence above or below the guideline range. The parties further 

4 


Case 2:17-cr-00124-JPS Filed 04/19/19 Page 4 of 19 Document 124 






understand and agree that if the defendant has provided false, incomplete, or 
inaccurate information that affects the calculations, the government is not hound to 
make the recommendations contained in this agreement. 

Relevant Conduct 


14. The parties acknowledge, understand, and agree that pursuant to 
Sentencing Guidelines Manual (U.S.S.G.) § IB 1.3, the sentencing judge may 
consider relevant conduct in calculating the sentencing guidelines range, even if the 
relevant conduct is not the subject of the offenses to which the defendant is pleading 
guilty. 


Base Offense Level and Specific Offense Characteristics 

15. The parties agree to recommend the following base offense levels and 
adjustments for specific offense characteristics: 

• For Count One, a multi-object conspiracy, U.S.S.G. § lB1.2(d) provides that 
the guidelines are to be calculated for each offense that is subject of the 
conspiracy, and under § 3Dl,2(d), all counts are grouped together: 

o Count One, Part A, conspiracy to violate 18 U.S.C. § 1030(a)(5): a base 
offense level of 6 under a §§ 2B1.1(a)(2) and 2X1.1(a); 2-level increase 
for an offense involving more than 10 victims under § 2B1.1(b)(2)(A); a 
2-level increase because a substantial part of the offense was 
committed outside of the United States under § 2Bl.l(b)(lO); a 2-level 
increase for a violation of 18 U.S.C. § 1030 with an intent to obtain 
personal information under § 2Bl.i(b)(l8)(A); a 4Tevel increase for an 
offense under 18 U.S.C. § 1030(a)(5); a 3-level reduction for conspiracy 
under § 2X1.1(b)(2). 

o Count One, Part B, conspiracy to violate 18 U.S.C. § 1030(a)(2): a base 
offense level of 6 under §§ 2B1,1(a)(2) and 2X1. l(a); a 2-level increase 
for an offense involving more than 10 victims under § 2B 1.1(b)(2)(A); a 
2-level increase because a substantial part of the offense was 
committed outside of the United States under § 2Bl,l(b)(lO); a 2-level 
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increase for a violation of 18 U.S.C. § 1030 with an intent to obtain 
personal information under § 2Bl.l(b)(l8)(A); a 3-level reduction for 
conspiracy under § 2X1.1(b)(2). 

o Count One, Part C, conspiracy to violate 18 U.S.C. § 251l(l)(a): a base 
offense level of 9 under §§ 2H3.1(a)(1) and 2X1.l(a); a 3-level reduction 
for conspiracy under § 2X1.1(b)(2). 

o The government may also recommend up to an 8-level adjustment 
under § 2B 1.1(b)(1)(E). 

• For Count Two : a base offense level of 6 under § 2H3.2(a) and a 3-level 
increase for commission of the offense for pecuniary gain under § 2H3.2(b), 

Acceptance of Responsibility 

16. The government agrees to recommend a two-level decrease for 
acceptance of responsibility as authorized by U.S.S.G. § 3El,l(a), but only if the 
defendant exhibits conduct consistent with the acceptance of responsibility, In 
addition, if the court determines at the time of sentencing that the defendant is 
entitled to the two-level reduction under § 3El.l(a), the government agrees to make 
a motion recommending an additional one-level decrease as authorized by 
Sentencing Guidelines Manual § 3El.l(b) because the defendant timely notified 
authorities of his intention to enter a plea of guilty. 

Sentencing Recommendations 

17. Both parties reserve the right to provide the district court and the 
probation office with any and all information which might be pertinent to the 
sentencing process, including but not limited to any and all conduct related to the 
offense as well as any and all matters which might constitute aggravating or 
mitigating sentencing factors. 
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18. Both parties reserve the right to make any recommendation regarding 
any and all factors pertinent to the determination of the sentencing guideline range,' 
the fine to be imposed; the amount of restitution and the terms and condition of its 
payment, the length of supervised release and the terms and conditions of the 
release! the defendant’s custodial status pending the sentencing,' and any other 
matters not specifically addressed by this agreement. 

19. The government agrees to make no recommendation regarding the 
ultimate sentence to be imposed; however, the government remains free to take a 
position with respect to any fact or factor pertinent to the sentencing decision 
consistent with this agreement and to advise the court that the government’s failure 
to make a sentencing recommendation should not be construed as a 
recommendation for leniency or severity. 

Court’s Determinations at Sentencing 

20. The parties acknowledge, understand, and agree that neither the 
sentencing court nor the United States Probation Office is a party to or bound by 
this agreement. The United States Probation Office will make its own 
recommendations to the sentencing court. The sentencing court will make its own 
determinations regarding any and all issues relating to the imposition of sentence 
and may impose any sentence authorized by law up to the maximum penalties set 
forth in paragraph 6 above. The parties further understand that the sentencing 
court will be guided by the sentencing guidelines but will not be bound by the 
sentencing guidelines and may impose a reasonable sentence above or below the 
calculated guideline range. 
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21. The parties acknowledge, understand, and agree that the defendant 
may not move to withdraw the guilty plea solely as a result of the sentence imposed 
by the court. 

FINANCIAL MATTERS 

22. The defendant acknowledges and understands that any and all 
financial obligations imposed by the sentencing court are due and payable in full 
upon entry of the judgment of conviction. The defendant further understands that 
any payment schedule imposed by the sentencing court shall be the minimum the 
defendant is expected to pay and that the government’s collection of any and all 
court imposed financial obligations is not limited to the payment schedule. The 
defendant agrees not to request any delay or stay in payment of any and all 
financial obligations. If the defendant is incarcerated, the defendant agrees to 
participate in the Bureau of Prisons’ Inmate Financial Responsibility Program, 
regardless of whether the court specifically directs participation or imposes a 
schedule of payments. 

23. The defendant agrees to provide to the Financial Litigation Unit 
(FLU) of the United States Attorney's Office upon request of the FLU during any 
period of probation or supervised release imposed by the court, a complete and 
sworn financial statement on a form provided by FLU and any documentation 
required by the form. 

Special Assessment 

24. The defendant agrees to pay the special assessment in the amount of 
$200 prior to or at the time of sentencing. 

8 


Case 2:17-cr-00124-JPS Filed 04/19/19 Page 8 of 19 Document 124 





DEFENDANTS WAIVER OF RIGHTS 


25. In entering this agreement, the defendant acknowledges and 
understands that he surrenders any claims he may have raised in any pretrial 
motion, as well as certain rights which include the following: 

a. If the defendant persisted in a plea of not guilty to the charges 
against him, he would be entitled to a speedy and public trial by a 
court or jury. The defendant has a right to a jury trial. However, in 
order that the trial be conducted by the judge sitting without a jury, 
the defendant, the government and the judge all must agree that 
the trial be conducted by the judge without a jury. 

b. If the trial is a jury trial, the jury would be composed of twelve 
citizens selected at random. The defendant and his attorney would 
have a say in who the jurors would be by removing prospective 
jurors for cause where actual bias or other disqualification is 
shown, or without cause by exercising peremptory challenges. The 
jury would have to agree unanimously before it could return a 
verdict of guilty. The court would instruct the jury that the 
defendant is presumed innocent until such time, if ever, as the 
government establishes guilt by competent evidence to the 
satisfaction of the jury beyond a reasonable doubt. 

c. If the trial is held by the judge without a jury, the judge would find 
the facts and determine, after hearing all of the evidence, whether 
or not he was persuaded of defendant’s guilt beyond a reasonable 
doubt. 

d. At such trial, whether by a judge or a jury, the government would 
be required to present witnesses and other evidence against the 
defendant. The defendant would be able to confront witnesses upon 
whose testimony the government is relying to obtain a conviction 
and he would have the right to cross-examine those witnesses. In 
turn the defendant could, but is not obligated to, present witnesses 
and other evidence on his own behalf. The defendant would be 
entitled to compulsory process to call witnesses. 

e. At such trial, defendant would have a privilege against self- 
incrimination so that he could decline to testify and no inference of 
guilt could be drawn from his refusal to testify. If defendant desired 
to do so, he could testify on his own behalf. 
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26. The defendant acknowledges and understands that by pleading guilty 
he is waiving all the rights set forth above. The defendant further acknowledges the 
fact that his attorney has explained these rights to him and the consequences of his 
waiver of these rights. The defendant further acknowledges that as a part of the 
guilty plea hearing, the court may question the defendant under oath, on the record, 
and in the presence of counsel about the offense to which the defendant intends to 
plead guilty. The defendant further understands that the defendant’s answers may 
later be used against the defendant in a prosecution for perjury or false statement. 

27. The defendant acknowledges and understands that he will be 
adjudicated guilty of the offenses to which he will plead guilty and thereby may be 
deprived of certain rights, including but not limited to the right to vote, to hold 
public office, to serve on a jury, to possess firearms, and to be employed by a 
federally insured financial institution. 

28. The defendant knowingly and voluntarily waives all claims he may 
have based upon the statute of limitations, the Speedy Trial Act, and the speedy 
trial provisions of the Sixth Amendment. The defendant agrees that any delay 
between the filing of this agreement and the entry of the defendant’s guilty plea 
pursuant to this agreement constitutes excludable time under the Speedy Trial Act. 

29. Based on the government’s concessions m this agreement, the 

defendant knowingly and voluntarily waives his right to appeal his conviction or 

sentence in this case and further waives his right to challenge his conviction or 

sentence in any post-conviction proceeding, including but not limited to a motion 

pursuant to 28 U.S.C. § 2255. As used in this paragraph, the term “sentence” means 
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any term of imprisonment, term of supervised release, term of probation, supervised 
release condition, fine, forfeiture order, and restitution order. The defendant’s 
waiver of appeal and post-conviction challenges includes the waiver of any claim 
that (l) the statutes or Sentencing Guidelines under which the defendant is 
convicted or sentenced are unconstitutional, and (2) the conduct to which the 
defendant has admitted does not fall within the scope of the statutes or Sentencing 
Guidelines. This waiver does not extend to an appeal or post-conviction motion 
based on (l) any punishment in excess of the statutory maximum, (2) the sentencing 
court’s reliance on any constitutionally impermissible factor, such as race, religion, 
or sex, (3) ineffective assistance of counsel in connection with the negotiation of the 
plea agreement or sentencing, or (4) a claim that the plea agreement was entered 
involuntarily. 

Further Civil or Administrative Action 
30. The defendant acknowledges, understands, and agrees that the 
defendant has discussed with his attorney and understands that nothing contained 
in this agreement, including any attachment, is meant to limit the rights and 
authority of the United States of America or any other state or local government to 
take farther civil, administrative, or regulatory action against the defendant, 
including but not limited to any listing and debarment proceedings to restrict rights 
and opportunities of the defendant to contract with or receive assistance, loans, and 
benefits from United States government agencies. 
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MISCELLANEOUS MATTERS 


31. The defendant recognizes that pleading guilty may have consequences 
with respect to the defendant’s immigration status if the defendant is not a citizen 
of the United States. Under federal law, a broad range of crimes are removable 
offenses, including the offense(s) to which defendant is pleading guilty. Removal 
and other immigration consequences are the subject of a separate proceeding, and 
the defendant understands that no one, including the defendant’s attorney or the 
sentencing court, can predict to a certainty the effect of the defendant’s conviction 
on the defendant’s immigration status. The defendant nevertheless affirms that the 
defendant wants to plead guilty regardless of any immigration consequences, 
including the potential for automatic removal from the United States. 

GENERAL MATTERS 

32. The parties acknowledge, understand, and agree that this agreement 
does not require the government to take, or not to take, any particular position in 
any post-conviction motion or appeal. 

33. The parties acknowledge, understand, and agree that the United 
States Attorney’s office is free to notify any local, state, or federal agency of the 
defendant’s conviction. 

34. The defendant understands that pursuant to the Victim and Witness 

Protection Act, the Justice for All Act, and regulations promulgated thereto by the 

Attorney General of the United States, the victim of a crime may make a statement 

describing the impact of the offense on the victim and further may make a 

recommendation regarding the sentence to be imposed. The defendant 
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acknowledges and understands that comments and recommendations by a victim 
may be different from those of the parties to this agreement. 

EFFECT OF DEFENDANT’S BREACH OF PLEA AGREEMENT 

35. The defendant acknowledges and understands if he violates any term 
of this agreement at any time, engages in any further criminal activity prior to 
sentencing, or fails to appear for sentencing, this agreement shall become null and 
void at the discretion of the government. The defendant further acknowledges and 
understands that the government’s agreement to dismiss any charge is conditional 
upon final resolution of this matter. If this plea agreement is revoked or if the 
defendant’s conviction ultimately is overturned, then the government retains the 
right to reinstate any and all dismissed charges and to file any and all charges 
which were not filed because of this agreement. The defendant hereby knowingly 
and voluntarily waives any defense based on the applicable statute of limitations for 
any charges filed against the defendant as a result of his breach of this agreement. 
The defendant understands, however, that the government may elect to proceed 
with the guilty plea and sentencing. If the defendant and his attorney have signed a 
proffer letter in connection with this case, then the defendant further acknowledges 
and understands that he continues to be subject to the terms of the proffer letter. 

VOLUNTARINESS OF DEFENDANTS PLEA 

36. The defendant acknowledges, understands, and agrees that he will 
plead guilty freely and voluntarily because he is in fact guilty. The defendant 
further acknowledges and agrees that no threats, promises, representations, or 
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other inducements have been made, nor agreements reached, other than those set 
forth in this agreement, to induce the defendant to plead guilty. 
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ACKNOWLEDGMENTS 


I am the defendant. I am entering into this plea agreement freely and voluntarily. I 
am not now on or under the influence of any drug, medication, alcohol, or other 
intoxicant or depressant, whether or not prescribed by a physician, which would 
impair my ability to understand the terms and conditions of this agreement. My 
attorney has reviewed every part of this agreement with me and has advised me of 
the implications of the sentencing guidelines. I have discussed all aspects of this 
case with my attorney and I am satisfied that my attorney has provided effective 
assistance of counsel. 

Date: 04/17/2019 _ 

MARCUS HUTCHINS 
Defendant 


I am the defendant’s attorney. I carefully have reviewed every part of this 
agreement with the defendant. To my knowledge, my client’s decision to enter into 
this agreement is an informed and voluntary one. 


Date: _ 

Date : 4/18/2019 

Pat *' MlVl lift 

For the United States of America: 
Date: /4 {_[ ^ 




BRIAN KLEIN 
Attorney for Defendant 


-- 



MARCIA HOFMANN 
Attorney for Defendant 

DANIEL STILLER 
Attorney for Defendant 


%^ 4/1 


^ MATTHEW D.KRUE ER 
United States Attorne 



Date 








BENJAMIN PROCTOR 




Assistant United States Attorney 



Date: ■ / 7-' / 1 


"■fc- 


BENJAMIN TAIBLESON 
Assistant United States Attorney 
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Attachment A 


Between July 2012 and September 2015, Marcus Hutchins helped create and, 
in partnership with another, sell malicious computer code, a/k/a malware, known as 
UPAS-Kit and Kronos. 1 During this time, Hutchins used aliases such as 
“Malwaretech” and “irp@jabber.se.” One of Hutchins’ partners, who went by aliases 
including “Vinny,” “VinnyK,” and “Auroral23,” advertised and sold the malware. 
Hutchins and '“Vinny” agreed to share the profits from the sales of the malware, and 
they sought to maximize their profits by selling the malware to as many people as 
possible, Hutchins also personally provided Kronos to an individual in California 
who, as Hutchins knew, was active in using malware to gain unlawful access to 
computers and victims’ personal information. Hutchins worked hard to conceal his 
role in the development and distribution of the malware. At the relevant time, 
Hutchins resided in the United Kingdom. 

UPAS and Kronos are similar types of malware that utilize, among other 
things, form grabbers, key loggers, and web injects to intercept communications and 
collect personal information, including usernames, passwords, email addresses, and 
financial data, from any number of victim computers. The information from the 
infected victim computers would then be relayed to the person running the control 
panel for the malware program. The malware concealed itself in legitimate 
programs already running on a victim computer, and the malware was configured to 
avoid anti-virus programs. The malware was designed to target banking 
information and to work on many types of web browsers, including Internet 
Explorer, Firefox, and Chrome. Installation of UPAS or Kronos on a computer 
removes, replaces, and modifies space and information on that computer thereby 
impairing the integrity and availability of data, a program, a system, and 
information on the computer. Since 2014, Kronos has been used to infect numerous 
computers around the world and steal banking information. This includes causing 
damage to 10 or more protected computers within a 1-year period. 

In furtherance of the conspiracy as set forth in Count One of the superseding 
indictment, and to accomplish the objects and purposes of the conspiracy, Hutchins 
and his coconspirators caused the following acts, among others, to be committed in 
the Eastern District of Wisconsin and elsewhere: 

a. Hutchins developed UPAS Kit and provided it to “Vinny,” who was 
using alias “Aurora 123” at the time. 

b. In July 2012, Auroral23 advertised UPAS Kit in online forums that 
were viewed by the FBI in the Eastern District of Wisconsin. The 
advertisement stated, among other things, that UPAS Kit “is meant to install 
on the system silently and not alert antivirus engines" and that its 


1 Terms such as “Kronos,” “UPAS Kit,” “malware,” “erypting,” “protected computer,” and 
“form grabber” are all defined in the Superseding Indictment, which is incorporated into this 
factual summary. 
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functionality included a USB spreader, FTP grabber, form grabber for 
Internet Explore, Firefox, and Chrome, and other items. 

c. On July 3, 2012, an FBI confidential source in the Eastern District of 
Wisconsin (CSX) purchased UPAS Kit from Auroral23 for SI,500 in digital 
currency. Later in July 2012, CS1 received an updated version UPAS from 
Auroral23. CS1 continued to have contact via online chats with Auroral23 
over several months regarding UPAS. 

d. Prior to July 2014, Hutchins developed Kronos and provided it to 
Vinny so that Vinny could advertise and sell Kronos to others. 

e. On July 13, 2014, a video showing the functionality of the “Kronos 
Banking trojan” was posted to YouTube. Vinny and Hutchins used the video 
to demonstrate how Kronos worked and to promote the sale of Kronos. 

f. In August 2014, Vinny advertised the sale of “Kronos Banking Trojan 
$3000 PM/WMZ/BTC” on the forum exploit.in. An FBI confidential source in 
the Eastern District of Wisconsin (CS2) engaged Vinny via online chats about 
Kronos and asked Vinny for a demonstration of Kronos. Virrny directed CS2 
to the YouTube video showing how Kronos works. 

g. On September 7, 2014, Vinny marketed Kronos to members of the 
Darkode forum. 

h. In February 2015, Hutchins and Vinny updated Kronos. On February 
9, 2015, in a chat with CS3, Hutchins described the update. CS3 asked, “[D]id 
you guys just happen to make a (sic) update?” Hutchins responded, “[W]e 
made a few fixes to both the panel and bot.” 

i. In February 2015, Hutchins sent Kronos to CS3, who was living in 
California. At that time, Hutchins knew CS3 was involved in the various 
cyber-based criminal enterprises including the unauthorized access of point- 
of-sale systems and the unauthorized access of ATMs, which is documented 
in numerous written chats between Hutchins and CS3. 

j. In April 2015, Vinny advertised Kronos on the AlphaBay market 
forum. The advertisement stated: “Kronos has an advanced Formgrabber 
that doesn’t use methods publicly available. It logs ALL POST request and 
returns the data to the control panel.” Vinny was offering a “Lifetime License 
of Kronos” for $3,000 in bitcoin. The YouTube video was included with the 
AlphaBay advertisement. 

k. On June 11, 2015, Vinny sold Kronos for $2,000 in WebMoney to CS2, 
who was in the Eastern District of Wisconsin. After the transfer of funds was 
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complete, Vinny configured the control panel using domains that CS2 had 
provided to Vinny, and transferred the Kronos code to CS2. 

l. On or about July 17, 2015, Vinny contacted CS2 asking if Kronos was 
working fine and whether CS2 needed any erypting services for Kronos. 

m. Throughout this time, Hutchins referred people interested in buying 
Kronos to Vinny. 

In addition to these specific acts, Hutchins discussed with CS3 his work on 
Kronos and his partnership with Vinny. These conversations were recorded in 
online chats between Hutchins and CS3, which were recovered by the FBI. For 
instance, in November 2014, Hutchins told CS3 that he thought he would be 
making around $100,000 per year selling Kronos with Vinny. Hutchins complained 
that, so far, he had only made $8,000 from 5 sales. Hutchins then told CS3 that he 
wondered if Vinny was misrepresenting sales and profits to Hutchins in order to 
keep more money for himself. Hutchins told CS3 that he (Hutchins) had the whole 
source code for Kronos, and that he had developed a “vnc” (virtual network control) 
for Kronos, but he refused to share it with Vinny until he confirmed that Vinny was 
not misrepresenting Kronos sales. Hutchins said that the “vnc will likely make lots 
of money.” CS3 then asked Hutchins if he would be willing to sell Kronos with the 
vnc on his own without Vinny, to which Hutchins responded “nah, I dont want to 
sell anything myselft.] too risky .” 

In December 2014, Hutchins told CS3 that he (Hutchins) needs to keep a low 
profile and that he hoped no one else knew he coded Kronos. Hutchins told CS3 that 
CS3 has “gotta be careful who you share with though, unless you’re confident that if 
these people turn fed and decide to rattle you for info on me, you won’t say shit[.]” 
Hutchins mentioned that Kronos sales were still slow, noting that the reason “could 
just be that the bot hasn’t got the attention yet.” Hutchins said that “people want 
the vnc before considering” purchasing Kronos. Hutchins went on to say that Vinny 
told him sales of Kronos will improve with the vnc. 

In January 2015, Hutchins again complained to CS3 about the lack of sales of 
Kronos. Later, Hutchins said that “Vinny brought some good news today . .. 
apparently someone posted a review and loads of people added him,” referring to a 
good review of Kronos that led many people to contact Vinny regarding Kronos. Also 
in January 2015, CS3 and Hutchins discussed seeing another person selling 
“cracked bins” of Kronos (a cracked version of Kronos) on an internet forum. 
Hutchins said that “if he actually cracked it [Kronos], there’s a little surprise for 
everyone who uses the cracked bins. . . . [T]here’s a ‘bug’ in the rootkit, where it may 
after some time accidently delete the bot file from the computer.” 

In February 2015, Hutchins told CS3 that he “made a few fixes” to Kronos, 
and that he was motivated to update Kronos because sales of Kronos had picked up 
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a little. Per CS3’s request, Hutchins sent Kronos to CS2, and Hutchins helped CS3 
get it to work properly on CS3 J s computer. 

In March 2015, Hutchins complained to CS3 that he wanted to be done 
selling Kronos with Vinny, but he cannot find anyone to take over for him. 

In May 2015, Hutchins told CS3 that due to a manufacturer’s update to the 
Chrome web browser, the Kronos formgrabber stopped working, Hutchins noted 
that if sales of Kronos were good, Vinny would be pressing Hutchins to fix the 
problem. 

In June 2015, Hutchins told CS3 that Vinny was trying to hire another coder 
to update Kronos. Hutchins said that this could get Hutchins in trouble because 
Hutchins knew the person Vinny wanted to hire, and that person would likely 
recognize that Hutchins developed the code for Kronos. Hutchins then concluded 
that sales of Kronos “aint going anywhere without me” because Vinny needs 
Hutchins’ skills to update Kronos and add the vnc, which no one else can do. 

In a conversation in September 2015, CS3 tried again to recruit Hutchins to 
work with him on malware. CS3 told Hutchins “i know you didn’t go all out in 
kronos.” Hutchins responded: “yeah[.] it was really just Upas with some tweaksU” 

Hutchins was arrested August 2, 2017. Following his arrest, Hutchins was 
advised of his Miranda rights orally and in writing, and he was advised that it was 
a crime to lie to FBI agents. In a post-arrest statement, Hutchins admitted to 
dealing with “Vinny,” including being paid by Vinny for developing code for UPAS 
and Kronos, which Vinny then sold. 
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